[okio_3_6_0]: https://square.github.io/okio/changelog/#version-360
 [public_suffix]: https://publicsuffix.org/
 [rfc_2045]: https://tools.ietf.org/html/rfc2045
 [rfc_7231_647]: https://tools.ietf.org/html/rfc7231#section-6.4.7
 [rfc_7692]: https://tools.ietf.org/html/rfc7692
 [semver]: https://semver.org/

  /**
   * If true, no new exchanges can be created on this connection. It is necessary to set this to
   * true when removing a connection from the pool; otherwise a racing caller might get it from the
   * pool when it shouldn't. Symmetrically, this must always be checked before returning a
   * connection from the pool.
   *
   * Once true this is always true. Guarded by this.
   */
  var noNewExchanges = false

  /**

  pos: Int,
  limit: Int,
): ByteArray? {
  val address = ByteArray(16)
  var b = 0
  var compress = -1
  var groupOffset = -1

  var i = pos
  while (i < limit) {
    if (b == address.size) return null // Too many groups.

    // Read a delimiter.
    if (i + 2 <= limit && input.startsWith("::", startIndex = i)) {
      // Compression "::" delimiter, which is anywhere in the input, including its prefix.

        return jdkWithJettyBoot
      }

      return Platform()
    }

    /**
     * Returns the concatenation of 8-bit, length prefixed protocol names.
     * http://tools.ietf.org/html/draft-agl-tls-nextprotoneg-04#page-4
     */
    fun concatLengthPrefixed(protocols: List<Protocol>): ByteArray {
      val result = Buffer()
      for (protocol in alpnProtocolNames(protocols)) {

    assertFailsWith<ProtocolException> {
      CertificateAdapters.subjectPublicKeyInfo.fromDer(bytes)
    }.also { expected ->
      assertThat(expected.message).isEqualTo("enclosed object too large")
    }
  }

  /** Object identifiers are nominally self-delimiting. Outrun the limit with one. */
  @Test fun `variable length long outruns limit`() {
    val bytes = "060229ffffff7f".decodeHex()

 *
 * Copy WireSharkKeyLoggerListener to your test code to use in development.
 *
 * This logs TLSv1.2 on a JVM (OpenJDK 11+) without any additional code.  For TLSv1.3
 * an existing external tool is required.
 *
 * See https://stackoverflow.com/questions/61929216/how-to-log-tlsv1-3-keys-in-jsse-for-wireshark-to-decode-traffic
 *
 * Steps to run in your own code
 *

    user.connectionConnectEnd(connection, route)

    // If we raced another call connecting to this host, coalesce the connections. This makes for
    // 3 different lookups in the connection pool!
    val pooled3 = routePlanner.planReusePooledConnection(this, routes)
    if (pooled3 != null) return pooled3.connection

    connection.withLock {
      connectionPool.put(connection)

   *
   * [rfc_7468]: https://tools.ietf.org/html/rfc7468
   */
  fun certificatePem(): String = certificate.certificatePem()

  /**
   * Returns the private key encoded in [PKCS #8][rfc_5208] [PEM format][rfc_7468].
   *
   * [rfc_5208]: https://tools.ietf.org/html/rfc5208
   * [rfc_7468]: https://tools.ietf.org/html/rfc7468
   */
  fun privateKeyPkcs8Pem(): String {

 *
 * The easiest way to pin a host is turn on pinning with a broken configuration and read the
 * expected configuration when the connection fails. Be sure to do this on a trusted network, and
 * without man-in-the-middle tools like [Charles][charles] or [Fiddler][fiddler].
 *
 * For example, to pin `https://publicobject.com`, start with a broken configuration:
 *
 * ```java
 * String hostname = "publicobject.com";

          newFixedLengthSource(contentLength)
        } else {
          newUnknownLengthSource()
        }
      }
    }
  }

  override fun trailers(): Headers {
    check(state == STATE_CLOSED) { "too early; can't read the trailers yet" }
    return trailers ?: EMPTY_HEADERS
  }

  override fun flushRequest() {
    sink.flush()
  }

  override fun finishRequest() {
    sink.flush()
  }